truncgit/citrus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

refactor: implement strict admin authentication for management actions and add PIN verification flow for client access

Browse Source
This commit is contained in:
Ümit Tunç
2026-07-30 18:10:06 +03:00
parent dcda744b4a
commit 6dd03cc9ca
2 changed files with 939 additions and 846 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/Http/Controllers/ProjectController.php
+46 -18
View File
@@ -25,10 +25,13 @@ class ProjectController extends Controller
// Recalculate progress dynamically
$project->recalculateProgress();
// Check if admin mode is active (logged in user OR session toggle)
$isAdminMode = Auth::check() || session()->get('admin_mode_' . $project->id, true);
// Strict Admin Check: ONLY logged-in admin users can edit/manage
$isAdminMode = Auth::check();
return view('projects.show', compact('project', 'isAdminMode'));
// Client PIN Verification Check: Admins are auto-verified, clients need PIN verification in session
$isVerified = $isAdminMode || session()->get('project_access_' . $project->id, false);
return view('projects.show', compact('project', 'isAdminMode', 'isVerified'));
}
/**
@@ -55,6 +58,13 @@ class ProjectController extends Controller
*/
public function updateModuleStatus(Request $request, string $slug)
{
if (!Auth::check()) {
if ($request->wantsJson() || $request->ajax()) {
return response()->json(['success' => false, 'message' => 'Bu işlem için yönetici girişi yapmanız gerekmektedir.'], 403);
}
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -67,8 +77,6 @@ class ProjectController extends Controller
->firstOrFail();
$module->update(['status' => $request->input('status')]);
// Recalculate overall progress %
$newProgress = $project->recalculateProgress();
if ($request->wantsJson() || $request->ajax()) {
@@ -87,6 +95,13 @@ class ProjectController extends Controller
*/
public function updateTaskStatus(Request $request, string $slug)
{
if (!Auth::check()) {
if ($request->wantsJson() || $request->ajax()) {
return response()->json(['success' => false, 'message' => 'Bu işlem için yönetici girişi yapmanız gerekmektedir.'], 403);
}
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -123,6 +138,10 @@ class ProjectController extends Controller
*/
public function addTask(Request $request, string $slug)
{
if (!Auth::check()) {
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -154,6 +173,13 @@ class ProjectController extends Controller
*/
public function deleteTask(Request $request, string $slug)
{
if (!Auth::check()) {
if ($request->wantsJson() || $request->ajax()) {
return response()->json(['success' => false, 'message' => 'Yetkisiz erişim.'], 403);
}
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -176,6 +202,10 @@ class ProjectController extends Controller
*/
public function addUpdate(Request $request, string $slug)
{
if (!Auth::check()) {
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -200,6 +230,13 @@ class ProjectController extends Controller
*/
public function deleteUpdate(Request $request, string $slug)
{
if (!Auth::check()) {
if ($request->wantsJson() || $request->ajax()) {
return response()->json(['success' => false, 'message' => 'Yetkisiz erişim.'], 403);
}
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$request->validate([
@@ -227,22 +264,13 @@ class ProjectController extends Controller
*/
public function recalculate(Request $request, string $slug)
{
if (!Auth::check()) {
return back()->withErrors(['error' => 'Yetkisiz erişim.']);
}
$project = Project::where('slug', $slug)->firstOrFail();
$pct = $project->recalculateProgress();
return back()->with('success', "Proje ilerleme yüzdesi yeniden hesaplandı: %{$pct}");
}
/**
* Toggle Admin / Client View Mode in session
*/
public function toggleAdminMode(Request $request, string $slug)
{
$project = Project::where('slug', $slug)->firstOrFail();
$key = 'admin_mode_' . $project->id;
$current = session()->get($key, true);
session()->put($key, !$current);
return back();
}
}